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Question: 1 


DRAG DROP 

Your network contains an Active Directory forest named contoso.com. The forest contains a Network 
Policy Server (NPS) server named NPS1 and a VPN server named VPN1. VPN1 forwards all 
authentication requests to NPS1. 

A partner company has an Active Directory forest named adatum.com. The adatum.com forest 
contains an NPS server named NPS2. 

You plan to grant users from adatum.com VPN access to your network. 

You need to authenticate the users from adatum.com on VPN1. 

What should you create on each NPS server? 

To answer, drag the appropriate objects to the correct NPS servers. Each object may be used once, 
more than once, or not at all. You may need to drag the split bar between panes or scroll to view 
content. 
y es) 


Objects Answer Area 

NPS1; Object 
a connection request policy 

Object 

a network policy H 
a RADIUS client i 

NPS2: Object 
a remote RADIUS server group 

Answer: 


nesi; 4 Connection request policy 


a remote RADIUS server group 


NPS2: a RADIUS client 


Question: 2 


HOTSPOT 
Your network contains an Active Directory domain named contoso.com. The domain contains the 
users shown in the following table. 
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You have a Network Policy Server (NPS) server that has the network policies shown in the following 
table. 


Policy1 Date and time restriction: 
Sunday 00:00 to Saturday 24:00 
Policy2 ____ [COnTOSO\Group1 Booo 


es CONTOSO\Group2 or CONTOSO [3 


User1, User2, and User3 plan to connect to the network by using a VPN. You need to identify which 
network policy will apply to each user. 

What should you identify? 

To answer, select the appropriate policy for each user in the answer area. 


Answer Area 


Useri: | -] 
Usere: | -] 
User3: | -] 


Answer Area 


Useri: | >| 


Answer: 
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Answer Area 


Useri q X 


Policy1 
Policy2 
Policy3 
Usere: b X 
Policy1 
Users: [ ~] 


When you configure multiple network policies in NPS, the policies are an ordered list of rules. NPS 
evaluates the policies in listed order from first to last. If there is a network policy that matches the 
connection request, NPS uses the policy to determine whether to grant or deny access to the user or 
computer connection. 

Network policies are evaulated according to the processing order. Once a match is found, no further 
network policy is processed. 

Policies are processed in this order: 

-Policy2 (applies only to members of Group1) 

-Policy1 (applies to all users during specified time slot) 

-Policy3 (applies only to members of Group2) 

Since policy1 will always apply (sunday 0:00 to saturday 24:00 = always), policy3 will never be 
evaluated. 

Correct answer is : 

User1: Policy2 

User2: Policy1 

User3: Policy1 

https://technet.microsoft.com/en-us/library/cc732724(v=ws.10).aspx 


Question: 3 


Your network contains an Active Directory domain named contoso.com. The domain contains a 
server named Server1 that runs Windows Server 2012 R2. 

Server1 has the following role services installed: 

DirectAccess and VPN (RRAS) 

Network Policy Server 

Remote users have client computers that run either Windows XP, Windows 7, or Windows 8. 

You need to ensure that only the client computers that run Windows 7 or Windows 8 can establish 
VPN connections to Server1. 

What should you configure on Server1? 


A. A condition of a Network Policy Server (NPS) network policy 

B. A constraint of a Network Policy Server (NPS) network policy 

C. a condition of a Network Policy Server (NPS) connection request policy 

D. A vendor-specific RADIUS attribute of a Network Policy Server (NPS) connection request policy 
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Answer: A 


Explanation: 

If you want to configure the Operating System condition, click Operating System, and then click Add. 
In Operating System Properties, click Add, and then specify the operating system settings that are 
required to match the policy. 

The Operating System condition specifies the operating system (operating system version or service 
pack number), role (client or server), and architecture (x86, x64, or ia64) required for the computer 
configuration to match the policy. 


Question: 4 


HOTSPOT 

Your network contains an Active Directory domain named contoso.com. The domain contains two 
servers named Server1 and Server2. Server1 has the Network Policy Server server role installed. 
Server2 has the DHCP Server server role installed. Both servers run Windows Server 2012 R2. 

You are configuring Network Access Protection (NAP) to use DHCP enforcement. 

You configure a DHCP scope as shown in the exhibit. (Click the Exhibit button.) 


| General | DNS | Network Access Protection | Advanced 


Network Access Protection 


You can setup the Network Access Protection settings for this scope 
here. 


Network Access Protection Settings 
(* Enable for this scope 


Use defaut Network Access Protection profile 
@ Use custom profile 


Profile Name 


Profile 


C Disable for this scope 


You need to ensure that non-compliant NAP clients receive different DHCP options than compliant 
NAP clients. 

What should you configure on each server? To answer, select the appropriate options for each server 
in the answer area. 
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Answer Area 


Server1: | 


Server2: | ~| 


Le 


Answer Area 


Health Policies 
Identity-Type 
MS-Service Class 


scope options 

server options 
a User class 

a Vendor class 


Answer: 


Explanation: 

Health Policies 

Server Options 

* Health policy on the NAP server. 

* The DHCP server must be NAP enabled. 

Note: With DHCP enforcement, a computer must be compliant to obtain an unlimited access IP 
address configuration from a DHCP server. For noncompliant computers, network access is limited by 
an IP address configuration that allows access only to the restricted network. DHCP enforcement 
enforces health policy requirements every time a DHCP client attempts to lease or renew an IP 
address configuration. DHCP enforcement also actively monitors the health status of the NAP client 
and renews the IPv4 address configuration for access only to the restricted network if the client 
becomes noncompliant. 


Question: 5 


You are a network administrator of an Active Directory domain named contoso.com. 

You have a server named Server1 that runs Windows Server 2012 R2. Server1 has the DHCP Server 
server role and the Network Policy Server role service installed. 

You enable Network Access Protection (NAP) on all of the DHCP scopes on Server1. 

You need to create a DHCP policy that will apply to all of the NAP non-compliant DHCP clients. 

Which criteria should you specify when you create the DHCP policy? 


A. The client identifier 
B. The user class 
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C. The vendor class 
D. The relay agent information 


Answer: B 


Explanation: 


Filters $ i= Failover | a Advanced 
General | DNS | Network Access Protection 


a Network Access Protection is working on this server. 
+ 


You can setup the Network Access Protection settings for the DHCP 
server here. 


Network Access Protection Settings 


Enable on all scopes Disable on all scopes 


DHCP server behaviour when Network Policy Server(NPS) is unreachable 


(* Full Access 
C Restricted Access 


C Drop Client Packet 


To configure a NAP-enabled DHCP server 

On the DHCP server, click Start, click Run, in Open, type dhcpmgmt. smc, and then press ENTER. 

In the DHCP console, open <servername>\IPv4. 

Right-click the name of the DHCP scope that you will use for NAP client computers, and then click 
Properties. 

On the Network Access Protection tab, under Network Access Protection Settings, choose Enable for 
this scope, verify that Use default Network Access Protection profile is selected, and then click OK. 

In the DHCP console tree, under the DHCP scope that you have selected, right-click Scope Options, 
and then click Configure Options. 

On the Advanced tab, verify that Default User Class is selected next to User class. 

Select the 003 Router check box, and in IP Address, under Data entry, type the IP address for the 
default gateway used by compliant NAP client computers, and then click Add. 

Select the 006 DNS Servers check box, and in IP Address, under Data entry, type the IP address for 
each router to be used by compliant NAP client computers, and then click Add. 

Select the 015 DNS Domain Name check box, and in String value, under Data entry, type your 
organization's domain name (for example, woodgrovebank. local), and then click Apply. This domain 
is a full-access network assigned to compliant NAP clients. 

On the Advanced tab, next to User class, choose Default Network Access Protection Class. 

Select the 003 Router check box, and in IP Address, under Data entry, type the IP address for the 
default gateway used by noncompliant NAP client computers, and then click Add. This can be the 
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same default gateway that is used by compliant NAP clients. 

Select the 006 DNS Servers check box, and in IP Address, under Data entry, type the IP address for 
each DNS server to be used by noncompliant NAP client computers, and then click Add. These can be 
the same DNS servers used by compliant NAP clients. 

Select the 015 DNS Domain Name check box, and in String value, under Data entry, type a name to 
identify the restricted domain (for example, restricted. Woodgrovebank. local), and then click OK. 
This domain is a restricted-access network assigned to noncompliant NAP clients. 

Click OK to close the Scope Options dialog box. 

Close the DHCP console. 

Reference: http: //technet.microsoft.com/en-us/library/dd296905%28v=ws.10%29.aspx 


Question: 6 


HOTSPOT 

Your network contains a RADIUS server named Server1. 

You install a new server named Server2 that runs Windows Server 2012 R2 and has Network Policy 
Server (NPS) installed. 

You need to ensure that all accounting requests for Server2 are forwarded to Server1. 

On Server2, you configure a Connection Request Policy. 

What else should you configure on Server2? To answer, select the appropriate node in the answer 
area. 


@ NPS (Local) 
4 | RADIUS Clients and Servers 
|g RADIUS Clients 
| Remote RADIUS Server Groups 


= * 


4 Ef Policies 
|) Connection Request Policies ] 
|} Network Policies | 
L] Health Policies | 
4 E, Network Access Protection 


p> a System Health Validators ] 
i Remediation Server Groups | 
S, Accounting 
b W Templates Management 


Answer: 
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| @ NPS (Local) 
4 >) RADIUS Clients and Servers 


c-o Si 


_ 35 RADIUS Clients 


Health Policies 

4 ™ Network Access Protection 

> aA System Health Validators 
BS Accounting 

b W Templates Management 


@ Network Policy Server x 


File Action View Help h 
@=| alr] da 


@ NPS (Local) 

4 |”) RADIUS Clients and Servers 
= RADIUS Clients i iti Settings 
& Remote RADIUS Server Groups 7 
4 E| Policies 


Configure the settings for this network policy. 


—— If conditio d constraints match the connection request and the policy grant: . settin lied. 
{© Connection Request Policies Sacred es a a nen 
Network Policies Settings: 
— ih Pekaes en Specify whether connection request sed locally, are forwarded to remot 
i ler conni n requests are proces: Ioi „are o remote 
4 W Network Access Protection buana RADIUS servers for authentication, or are accepted without authentication. 
p a System Health Validators & Authentication Methods 


#4 Remediation Server Groups c 5 
a aain p Bria © Authenticate requests on this server 

4 Wh Templates Management | -Ameni | @ Forward requests to the following remote RADIUS server group for authentication: 
[E] Shared Secrets 
3 RADIUS Clients coum Group] 7] [nee 
=l Remote RADIUS Servers Specify a Realm Name On WET EAE 
E IP Filters 5 Attribute ©) Accept users without val g credential 
1 Health Policies RADIUS Attributes 


Gq Remediation Server Groups @ Standard 


(4 Vendor Specific 


Question: 7 


Your network contains an Active Directory domain named contoso.com. The domain contains a 
server named Server1 that runs Windows Server 2012 R2 and has the Network Policy Server role 
service installed. 

An administrator creates a RADIUS client template named Template1. 

You create a RADIUS client named Client1 by using Template 1. 
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You need to modify the shared secret for Client1. 
What should you do first? 


A. Configure the Advanced settings of Template1. 

B. Set the Shared secret setting of Template1 to Manual. 
C. Clear Enable this RADIUS client for Client1. 

D. Clear Select an existing template for Client1. 


Answer: D 


Explanation: 

Clear checkmark for Select an existing template in the new client wizard. 

In New RADIUS Client, in Shared secret, do one of the following: 

Bullet Ensure that Manual is selected, and then in Shared secret, type the strong password that is 
also entered on the RADIUS client. Retype the shared secret in Confirm shared secret. 


| Settings | Advanced | 


[V] Enable this RADIUS client 


[V] Select an existing template: 
[Template 


Name and Address 
Friendly name: 
[Cient1 


Address (IP or DNS): 
192.168.1.1 


To manually type a shared secret, click Manual. To automatically generate a shared 
secret, click Generate. You must configure the RADIUS client with the same shared 
secret entered here. Shared secrets are case-sensitive. 


* Manual Generate 
Shared secret: 
eee 


Confirm shared secret: 
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Settings | Advanced 


[V] Enable this RADIUS client 


[_] Select an existing template: 


Template 


Name and Address 
Friendly name: 
[Client 


Address (IP or DNS): 
[192.168.1.1 


pe a shared cret, cilici al. |o automatically generate a shared 
secret, click Generate. You must configure the RADIUS client with the same shared 
secret entered here. Shared secrets are case-sensitive. 


Shared secret: 
[eee 


Confirm shared secret: 


eS 


Question: 8 


Your network contains an Active Directory domain named contoso.com. All servers run Windows 
Server 2012 R2. 

The domain contains a server named Server1 that has the Network Policy Server server role and the 
Remote Access server role installed. The domain contains a server named Server2 that is configured 
as a RADIUS server. 

Server1 provides VPN access to external users. 

You need to ensure that all of the VPN connections to Server1 are logged to the RADIUS server on 
Server2. 

What should you run? 


A. Add-RemoteAccessRadius -ServerNameServerl -AccountingOnOffMsg Enabled -SharedSecret 
"Secret" -Purpose Accounting 

B. Set-RemoteAccessAccounting -AccountingOnOffMsg Enabled -AccountingOnOffMsg Enabled 

C. Add-RemoteAccessRadius -ServerName Server2 -AccountingOnOffMsg Enabled -SharedSecret 
"Secret" -Purpose Accounting 

D. Set-RemoteAccessAccounting -EnableAccountingType Inbox -AccountingOnOffMsg Enabled 


Answer: C 
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Explanation: 

Add-RemoteAccessRadius 

Adds a new external RADIUS server for VPN authentication, accounting for DirectAccess (DA) and 
VPN, or one-time password (OTP) authentication for DA. 

AccountingOnOffMsg<String> 

Indicates the enabled state for sending of accounting on or off messages. The acceptable values for 
this parameter are: 

Enabled. 

Disabled. This is the default value. 

This parameter is applicable only when the RADIUS server is being added for Remote Access 
accounting. 


Question: 9 


Your network contains four Network Policy Server (NPS) servers named Server1, Server2, Servers, 
and Server4. 

Server1 is configured as a RADIUS proxy that forwards connection requests to a remote RADIUS 
server group named Group1. 

You need to ensure that Server2 and Server3 receive connection requests. Server4 must only receive 
connection requests if both Server2 and Server3 are unavailable. 

How should you configure Group1? 


A. Change the Weight of Server4 to 10. 
B. Change the Weight of Server2 and Server3 to 10. 
C. Change the Priority of Server2 and Server3 to 10. 
D. Change the Priority of Server4 to 10. 


Answer: D 


Explanation: 

During the NPS proxy configuration process, you can create remote RADIUS server groups and then 
add RADIUS servers to each group. To configure load balancing, you must have more than one 
RADIUS server per remote RADIUS server group. While adding group members, or after creating a 
RADIUS server as a group member, you can access the Add RADIUS server dialog box to configure the 
following items on the Load Balancing tab: 

Priority. Priority specifies the order of importance of the RADIUS server to the NPS proxy server. 
Priority level must be assigned a value that is an integer, such as 1, 2, or 3. The lower the number, the 
higher priority the NPS proxy gives to the RADIUS server. For example, if the RADIUS server is 
assigned the highest priority of 1, the NPS proxy sends connection requests to the RADIUS server 
first; if servers with priority 1 are not available, NPS then sends connection requests to RADIUS 
servers with priority 2, and so on. You can assign the same priority to multiple RADIUS servers, and 
then use the Weight setting to load balance between them. 

Weight. NPS uses this Weight setting to determine how many connection requests to send to each 
group member when the group members have the same priority level. Weight setting must be 
assigned a value between 1 and 100, and the value represents a percentage of 100 percent. For 
example, if the remote RADIUS server group contains two members that both have a priority level of 
1 and a weight rating of 50, the NPS proxy forwards 50 percent of the connection requests to each 
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RADIUS server. 

Advanced settings. These failover settingsprovide a way for NPS to determine whether the remote 
RADIUS server is unavailable. If NPS determines that a RADIUS server is unavailable, it can start 
sending connection requests to other group members. With these settings you can configure the 
number of seconds that the NPS proxy waits for a response from the RADIUS server before it 
considers the request dropped; the maximum number of dropped requests before the NPS proxy 
identifies the RADIUS server as unavailable; and the number of seconds that can elapse between 
requests before the NPS proxy identifies the RADIUS server as unavailable. 

The default priority is 1 and can be changed from 1 to 65535. So changing server 2 and 3 to priority 
10 is not the way to go. 


[Address | Authenticaion/Accounting | Load Balancing | 


The pronty of ranking indicates the status of a server. A primary server has a pronty of 
1. 


Weight is used to calculate how often request are sent to a specific server in a group of 
servers that have the same priority. 


Prionty: Weight: 


Advanced settings 


Number of seconds without response before request is 
considered dropped: 


Maximum number of dropped requests before server is 
identified as unavailable: 


Number of seconds between requests when server is identified 
as unavailable: 


Reference: http: //technet. microsoft. com/en-us/library/dd197433(WS. 10). aspx 


Question: 10 


DRAG DROP 

Your network contains an Active Directory domain named contoso.com. All domain controllers run 
Windows Server 2012 R2. 

The domain contains an organizational unit (OU) named OU1. OU1 contains an OU named OU2. OU2 
contains a user named user1. 

User1 is the member of a group named Group1. Group! is in the Users container. 

You create five Group Policy objects (GPO). The GPOs are configured as shown in the following table. 
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GPO name Linked to Enforced setting — Additional permissions 
Groupi - Deny Apply Group Policy 
Disabled Not applicable 
Group1 - Deny Read 
GPO4 oui Disabled Not applicable 
GPO5 ou2 [Enabled Group! — Full control 


The Authenticated Users group is assigned the default permissions to all of the GPOs. 

There are no site-level GPOs. 

You need to identify which three GPOs will be applied to User1 and in which order the GPOs will be 
applied to User1. 

Which three GPOs should you identify in sequence? To answer, move the appropriate three GPOs 


from the list of GPOs to the answer area and arrange them in the correct order. 


Actions Answer Area 


GPOS 
GPO3 
GPO2 
GPO1 


GPO4 


Answer: 


Explanation: 

Box 1: GPO2 

Box 2: GPO4 

Box 3: GPOS 

Note: 

* First at the domain level (GPO2), then at the highest OU level GPO4, and finally at the OU level 
containing user1 GPOS. 

Incorrect: 

* Read and Apply group policy are both needed in order for the user or computer to receive and 
process the policy 

Not GPO1: Group1 has Deny Apply Group Policy permissions on GPO1. 

Not GPO3: Group1 has Deny Read permissions on GPO3. 

GPO2 and GPO4 are disabled. 

* When a Group Policy Object (GPO) is enforced it means the settings in the Group Policy Object on 
an Organization Unit (which is shown as a folder within the Active Directory Users and Computers 
MMC) cannot be overruled by a Group Policy Object (GPO) which is link enabled on an Organizational 
Unit below the Organizational Unit with the enforced Group Policy Object (GPO). 
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* Group Policy settings are processed in the following order: 

1 Local Group Policy object 

2 Site. 

3 Domain 

4 Organizational units 

GPOs that are linked to the organizational unit that is highest in the Active Directory hierarchy are 
processed first, then GPOs that are linked to its child organizational unit, and so on. Finally, the GPOs 
that are linked to the organizational unit that contains the user or computer are processed. 


Question: 11 


Your network contains an Active Directory domain named adatum.com. 

A network administrator creates a Group Policy central store. 

After the central store is created, you discover that when you create new Group Policy objects 
(GPOs), the GPOs do not contain any Administrative Templates. 

You need to ensure that the Administrative Templates appear in new GPOs. 

What should you do? 


A. Add your user account to the Group Policy Creator Owners group. 
B. Configure all domain controllers as global catalog servers. 

C. Copy files from %Windir%\Policydefinitions to the central store. 
D. Modify the Delegation settings of the new GPOs. 


Answer: C 


Explanation: 

To take advantage of the benefits of .admx files, you must create a Central Store in the SYSVOL folder 
on a domain controller. The Central Store is a file location that is checked by the Group Policy tools. 
The Group Policy tools use any .admx files that are in the Central Store. The files that are in the 
Central Store are later replicated to all domain controllers in the domain. 


Question: 12 


Your network contains an Active Directory domain named contoso.com. All domain controllers run 
Windows Server 2012 R2. The domain contains 500 client computers that run Windows 8 Enterprise. 
You implement a Group Policy central store. 

You have an application named App1. App1 requires that a custom registry setting be deployed to all 
of the computers. 

You need to deploy the custom registry setting. The solution must minimize administrator effort. 
What should you configure in a Group Policy object (GPO)? 


A. The Software Installation settings 
B. The Administrative Templates 

C. An application control policy 

D. The Group Policy preferences 


Answer: D 
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Explanation: 

Open the Group Policy Management Console. Right-click the Group Policy object (GPO) that should 
contain the new preference item, and then click Edit. 

In the console tree under Computer Configuration or User Configuration, expand the Preferences 
folder, and then expand the Windows Settings folder. 

Right-click the Registry node, point to New, and select Registry Item. 

Group Policy preferences provide the means to simplify deployment and standardize configurations. 
They add to Group Policy a centralized system for deploying preferences (that is, settings that users 
can change later). 

You can also use Group Policy preferences to configure applications that are not Group Policy-aware. 
By using Group Policy preferences, you can change or delete almost any registry setting, file or folder, 
shortcut, and more. You are not limited by the contents of Administrative Template files. The Group 
Policy Management 

Editor (GPME) includes Group Policy preferences. 

References: 

http: //technet.microsoft.com/en-us/library/gg699429.aspx 

http: //www. unidesk. com/blog/gpos-set-custom-registry-entries-virtual-desktops-disabling- 
machine-password 


File Action View Help 
e am ana ae Hm Ber 


‘=! XP [SERVER1.HOME.LOCAL] Policy 
a (& Computer Configuration 
b £] Policies 


Name Order Action 


Environment i There are no items to show in this view, 
ag?! Files 

Œ Folders 
(Š) Ini Files 


All Tasks Collection Item 
4 Gu ControlPt) ew J Registry Wizard 
a Data $ 
£ Device Copy 
Cy Folder Paste Description 
G Local t Print No policies selected 
Netwa 
= Refresh 
wa Power . 
$ Printer Export List... 
E Schedi Help 
By Services 
4 #8 User Configuration 
p £] Policies 
b —| Preferences 


\ Preferences 


Creates a new item in this container. 
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File Action View Help 
e| 2m] hale aB) am Bor 
1} NAP [DC1.HOME.LOCAL] Polic 
4 i 
p £] Policies 
Pam 


Name | Order Action Hive 
a L Windows Settings 


[38] Environment : There are no items to show in this view. 


ag?! Files 
Œ Folders 


Ini Files 


eal Network Shares 
[Z] Shortcuts 
b Control Panel Settinc 
4 §% User Configuration 
b _ Policies 
bp | Preferences Description 


No policies selected 


Question: 13 


Your network contains two Active Directory forests named contoso.com and dev.contoso.com. The 
contoso.com forest contains a domain controller named DC1. The dev.contoso.com forest contains a 
domain controller named DC2. Each domain contains an organizational unit (OU) named OU1. 
Dev.contoso.com has a Group Policy object (GPO) named GPO1. GPO1 contains 200 settings, 
including several settings that have network paths. GPO1 is linked to OU1. 

You need to copy GPO1 from dev.contoso.com to contoso.com. 

What should you do first on DC2? 


A. From the Group Policy Management console, right-click GPO1 and select Copy. 

B. Run the mtedit.exe command and specify the /Domaintcontoso.com /DC: DC 1 parameter. 
C. Run the Save-NetGpocmdlet. 

D. Run the Backup-Gpocmdlet. 


Answer: A 


Explanation: 

To copy a Group Policy object: 

In the GPMC console tree, right-click the GPO that you want to copy, and then click Copy. 

To create a copy of the GPO in the same domain as the source GPO, right-click Group Policy objects, 
click Paste, specify permissions for the new GPO in the Copy GPO box, and then click OK. 

For copy operations to another domain, you may need to specify a migration table. 

The Migration Table Editor (MTE) is provided with Group Policy Management Console (GPMC) to 
facilitate the editing of migration tables. Migration tables are used for copying or importing Group 
Policy objects (GPOs) from one domain to another, in cases where the GPOs include domain-specific 
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information that must be updated during copy or import. 

Source WS2008R2: Backup the existing GPOs from the GPMC, you need to ensure that the “Group 
Policy Objects” container is selected for the “Backup Up All” option to be available. 

Copy a Group Policy Object with the Group Policy Management Console (GPMC) 

You can copy a Group Policy object (GPO) either by using the drag-and-drop method or right-click 
method. 

Applies To: Windows 8, Windows Server 2008 R2, Windows Server 2012 

References: 

http://technet.microsoft.com/en-us/library/cc785343(v=WS.10).aspx 
http://technet.microsoft.com/en-us/library/cc733107.aspx 


Question: 14 


Your network contains an Active Directory domain named contoso.com. All servers run Windows 
Server 2012 R2. 

Client computers run either Windows 7 or Windows 8. All of the client computers have an 
application named App1 installed. 

The domain contains a Group Policy object (GPO) named GPO1 that is applied to all of the client 
computers. 

You need to add a system variable named App1Data to all of the client computers. 

Which Group Policy preference should you configure? 


A. Environment 
B. Ini Files 
C. Data Sources 
D. Services 


Answer: A 


Explanation: 

Environment Variable preference items allow you to create, update, replace, and delete user and 
system environment variables or semicolon-delimited segments of the PATH variable. Before you 
create an Environment Variable preference item, you should review the behavior of each type of 
action possible with this extension. 


Question: 15 


Your network contains an Active Directory domain named contoso.com. 

All user accounts reside in an organizational unit (OU) named OU1. 

You create a Group Policy object (GPO) named GPO1. You link GPO1 to OU1. You configure the Group 
Policy preference of GPO1 to add a shortcut named Link1 to the desktop of each user. 

You discover that when a user deletes Link1, the shortcut is removed permanently from the desktop. 
You need to ensure that if a user deletes Link1, the shortcut is added to the desktop again. 

What should you do? 


A. Enforce GPO1. 
B. Modify the Link1 shortcut preference of GPO1. 
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C. Enable loopback processing in GPO1. 
D. Modify the Security Filtering settings of GPO1. 


Answer: B 


Explanation: 

Replace Delete and recreate a shortcut for computers or users. The net result of the Replace action is 
to overwrite the existing shortcut. If the shortcut does not exist, then the Replace action creates a 
new shortcut. 

This type of preference item provides a choice of four actions: Create, Replace, Update, and Delete. 
The behavior of the preference item varies with the action selected and whether the shortcut already 
exists. 


Create Create a new shortcut for computers or users. 
Remove a shortcut for computers or users. 


EAA Delete and recreate a shortcut for computers or users. The net result of the Replace action is to overwrite the 
p existing shortcut. If the shortcut does not exist, then the Replace action creates a new shortcut. 


shortcut settings defined within the preference item. All other settings remain as configured in the shortcut. If the 
shortcut does not exist, then the Update action creates a new shortcut. 


orne Modify settings of an existing shortcut for computers or users. This action differs from Replace in that it only updates 
Update 


Refernces: 
http: //technet.microsoft.com/en-us/library/cc753580.aspx 
http: //technet.microsoft.com/en-us/library/cc753580.aspx 


Question: 16 


HOTSPOT 

Your network contains an Active Directory domain named contoso.com. 

You have several Windows PowerShell scripts that execute when client computers start. 

When a client computer starts, you discover that it takes a long time before users are prompted to 
log on. 

You need to reduce the amount of time it takes for the client computers to start. The solution must 
not prevent scripts from completing successfully. 

Which setting should you configure? To answer, select the appropriate setting in the answer area. 
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File Action View Help 


i Allow logon scripts when NetBIOS or WINS is disabled 
LE, Specify maamum wait time for r Group f Palicy scripts 

LE, Run Windows PowerShell scripts first at computer startup, 4.. 

¿3 Run logon senpts synchronously 

t | Display í instructions m shutdown scripts as they run 

mi Run startup scnpts asynchronously 

3 Èl Display instructions in startup scripts as they run 


E Run Windows PowerShell scripts first at user logon, logoff 


\ Extended A Standard / 
8 setting(s) 


File Action Yiew Help 

= => 2 m Ss 2m Tv 

Setting 

i) Allow logon scripts when NetBIOS or WINS is disabled 
E : Specify maamum wait time for Group Policy scripts 


kal y Run Windows P PowerShell scripts first at computer startu tup, 3 


itz] Run logon scnpts synchronously 
b Display instructions in shutdown scrip 


i| Display instructions in startup scripts as they run 


[E Run Windows PowerShell scripts first at user logon, logoff 


State 
Not configured 


| Not configured 
. | Not configured 
| Not configured 
| Not configured 


Not configured 
Not configured 


| Not configured 


State 
Not configured 


a, = Not configured 


Not configured 
Not confiqured 
Not configured 
Not configured 
Not configured 
Not configured 
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Comment 
No 
No 


Answer: 


Comment 
No 


\ Extended ) Standard | 
8 setting(s) 


Explanation: 

Lets the system run startup scripts simultaneously rather than waiting for each to finish 

http: //technet. microsoft. com/en-us/library/cc939423. aspx 

Directs the system to wait for logon scripts to finish running before it starts the Windows Explorer 
interface program and creates the desktop. 

If you enable this policy, Windows Explorer does not start until the logon scripts have finished 
running. This setting assures that logon script processing is complete before the user starts working, 
but it can delay the appearance of the desktop. 

If you disable this policy or do not configure it, the logon scripts and Windows Explorer are not 
synchronized and can run simultaneously. 

This policy appears in the Computer Configuration and User Configuration folders. The policy set in 
Computer Configuration takes precedence over the policy set in User Configuration. 

By default, the Fast Logon Optimization feature is set for both domain and workgroup members. This 
setting causes policy to be applied asynchronously when the computer starts and the user logs on. 
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The result is similar to a background refresh. The advantage is that it can reduce the amount of time 
it takes for the logon dialog box to appear and the amount of time it takes for the desktop to become 
available to the user. Of course, it also means that the user may log on and start working before the 
absolute latest policy settings have been applied to the system. 

Depending on your environment, you may want to disable Fast Logon Optimization. You can do this 
with Group Policy, using the Always wait for the network at computer startup and logon policy 


setting. 
E] NAP [DC1.HOME.LOCAL] Policy * || Setting State Comment 
4 (& Computer Configuration liz] Allow users to select when a password is required when resu.. Not configured No 
4 Policies UE) Turn on PIN sign-in Not configured No 
b C] Software Settings l] Turn off picture password sign-in Not configured No 


b C Windows Settings 


sis : . _— LE) Assign a default domain for logon Not configured No 
4 | Administrative Templates: Policy definitior liż] Exclude credential providers Not configured No 
p -= meea liż] Do not process the legacy run list Not configured No 
Ls =) p aes | Do not process the run once list Not configured No 
E aera iż] Turn off app notifications on the lock screen Not configured No 
SS) Server zy pp g 
b TV! 
BA Start Menu and Taskbar _ ||| [| Turn off Windows Startup sound Not configured No 
4 E] System ~ ||| EE] Do not display network selection UI Not configured No 
E Access-Denied Assistance liż] Do not enumerate connected users on domain-joined com... Not configured No 
g P p LE) Show first sign-in animation Not configured No 
©) Audit Process Creation 9g g 
1 3 i iż] Enumerate local users on domain-joined computers Not configured No 
T] Credentials Delegation Ez J P g 
p Device Installation liz] Hide entry points for Fast User Switching Not configured No 
= Disk NV Cache l=] Always use classic logon Not configured No 
C] Disk Quotas =| Do not display the Getting Started welcome screen at logon Not configured No 
p £ Distributed COM iz Not configured 


F Driver Installation 

E] Early Launch Antimalware 

F File Classification Infrastructure 

| File Share Shadow Copy Provider 
Filesystem 

Folder Redirection 

Group Policy 

Internet Communication Managem 
iSCSI 

KDC 

E] Kerberos 


: Locale Services 


b 1 Net Logon 


li] Always use custom logon background ot configure 


B BE 


BEBE 


Refernces: 

http: //technet. microsoft. com/en-us/magazine/gg486839. aspx 
http: //technet. microsoft. com/en-us/magazine/gg486839. aspx 
http: //technet. microsoft. com/en-us/library/cc958585. aspx 


Question: 17 


HOTSPOT 

Your network contains an Active Directory domain named contoso.com. The domain contains a 
member server named Server1. Server1 runs Windows Server 2012 R2. 

You enable the EventLog-Application event trace session. 

You need to set the maximum size of the log file used by the trace session to 10 MB. 

From which tab should you perform the configuration? To answer, select the appropriate tab in the 
answer area. 
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[race Buffers || fie | Eee | Ser condton 
Le ese 


Application-Addon-Event-Provider 

Eror instrument 

Microsoft-Windows-All-User-instail-Agent 
Microsoft-Windows-AppHost 
Microsoft-Windows-Application Server-Applications 
Microsoft-Windows-Application-Eqerience 

ee -Windows- icant ahaa nai | 


Events up to this lev... 
These additional dat... 


Answer: 
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Application-Addon-Event-Provider 

Eror instrument 

Microsoft-Windows-ActionQueue 
Microsoft-Windows-All-Uiser-install-Agent 
Microsoft-Windows-App Host 
Microsoft-Windows-Application Server-Applications 
Microsoft-Windows-Application-Experience 
Microsoft-Windows-Application Eperiencelnfrastnu... 


Events with all of the... 
Events up to this lev.. 
These additional dat... 


Explanation: 

Note: By default, logging stops only if you set an expiration date as part of the logging schedule. 
Using the options on the Stop Condition tab, you can configure the log file to stop automatically after 
a specified period of time, such as seven days, or when the log file is full (if you’ve set a maximum 
size limit). 

Reference: http: //technet. microsoft. com/en-us/magazine/ff458614. aspx 
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®) File Action View Window Help 


e| 2m] XOes|\m) > m da 


® Performance Name Status 
4 |g Monitoring Tools P AlTEventLog Disabled 
E Performance Monitor T Audio Enabled 
4 E3 Data Collector Sets P Circular Kernel Context Logger Disabled 
a TÉ, User Defined WDiaglog Enabled 
W Server Manager Performance Monitor =a 
ai aren ‘ 2 : EventLog-ForwardedEvents Enabled 
=< a P EventLog-Security Enabled 
D Seii Performance T EventLog-System Egape 
D Event Trace Sessions ə LaiNeti og Denhe 
Eel Startup Event Trace Sessions P Microsoft-Windows-Dedup-Filt... Enabled 
“4 È Reports P Microsoft-Windows-Dedup-Filt... Enabled 
> a User Defined P Microsoft-Windows-Setup Disabled 
> ÉE System P NBSMBLOGGER Disabled 
T NtfsLog Enabled 
P PEAuthLog Disabled 
WRAC_PS Disabled 
P Radrlog Disabled 
P ReFSWmiLog Disabled 
P SetupPlatform Disabled 
P SQMLogger Disabled 
sum Enabled 
P TCPIPLOGGER Disabled 
PTpm Disabled 


[| Overall duration: Units: 

o ë # | Seconds “x | 
Limits 
[_] Restart the data collector set at limits 


|_| Duration: Units: 
lo Cal 


| fe | Seconds 


v 
e=. 


[C] Stop when all data collectors have finished 


Question: 18 
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HOTSPOT 

Your network contains an Active Directory domain named contoso.com. The domain contains three 
member servers named Server1, Server2, and Server3. All servers run Windows Server 2012 R2 and 
have the Windows Server Update Services (WSUS) server role installed. 

Server1 and Server2 are configured as replica servers that use Server3 as an upstream server. 

You remove Servers from the network. 

You need to ensure that WSUS on Server2 retrieves updates from Server1. The solution must ensure 
that Server1 and Server2 have the latest updates from Microsoft. 

Which command should you run on each server? To answer, select the appropriate command to run 
on each server in the answer area. 


Serverl | M 


Server2 | -] 
Serverl -l 


set-wsusserversynchronization -syncfrommu 
set-wsusserversynchronization -useservername server 1 


set-wsusserversynchronization -useservername server2 
wsusutil,exe movecontent \\server1\cé 
wsusutil.exe movecontent \\server2\ct 


Server2 -] 


set-wsusserversynchronization -syncfrommu 
set-wsusserversynchronization -useservername server 
set-wsusserversynchronization -useservername server2 
wsusutil,exe movecontent \\server1\c$ 

wsusutil.exe movecontent \\server2\ct 


Answer: 


set-wsusserversynchronization —-useservername server 1 
set-wsusserversynchronization -useservername server2 
wsusutilexe movecontent \\server1\ct 
wsusutil.exe movecontent \\server2\c$ 


Server2 -] 


set-wsusserversynchronization -useservername server2 
wsusutil,exe movecontent \\server1\c$ 


Explanation: 

Set-WsusServerSynchronization-SyncFromMU [-UpdateServer<|UpdateServer> ] [-Confirm] [-Whatlf] 
[ <CommonParameters>] 

Set-WsusServerSynchronization-UssServerName<String> [-PortNumber<Int32> ]  [-Replica]  [- 
UpdateServer<|lUpdateServer> | [-UseSsl] [-Confirm] [-Whatlf] [<CommonParameters>] 

The Set-WsusServerSynchronizationcmdlet sets whether the Windows Server Update Services 
(WSUS) server synchronizes from Microsoft Update or an upstream server. This cmdlet allows the 
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user to specify settings such as the upstream server name, the port number, and whether or not to 
use Secure Sockets Layer (SSL). 

References: 

http: //technet. microsoft. com/en-us/library/hh826163. aspx 

http: //technet. microsoft. com/en-us/library/cc708480%28v=ws. 10%29. aspx 


Question: 19 


You manage a server that runs Windows Server 2012 R2. The server has the Windows Deployment 
Services server role installed. 

You have a desktop computer that has the following configuration: 

Computer name: Computer1 

Operating system: Windows 8 

MAC address: 20-CF-30-65-D0-87 

GUID: 979708BF-CO4B-4525-9FEO-C4150BB6C618 

You need to configure a pre-staged device for Computer1 in the Windows Deployment Services 
console. 

Which two values should you assign to the device ID? (Each correct answer presents a complete 
solution. Choose two.) 


A. 20CF3065D08700000000000000000000 
B. 979708BFCO4B45259FEOC4150BB6C618 
C. 979708BF-CO04B-452S-9FEO-C4150BB6C618 
D. 0000000000000000000020CF306SD087 
E. 00000000-0000-0000-0000-C41S0BB6C618 


Answer: C, D 


Explanation: 

In the text box, type the client computer's MAC address preceded with twenty zeros or the globally 
unique identifier (GUID) in the format: {XXXXXXXX-XXXX-XXXX-XXX-XXXXXXXXXXXX}. 

* To add or remove pre-staged client to/from AD DS, specify the name of the computer or the device 
ID, which is a GUID, media access control (MAC) address, or Dynamic Host Configuration Protocol 
(DHCP) identifier associated with the computer. 

* Example: Remove a device by using its ID from a specified domain 

This command removes the pre-staged device that has the specified ID. The cmdlet searches the 
domain named TSQA.contoso.com for the device. 

Windows PowerShell 

PS C:\> Remove-WdsClient -DevicelD '"Sa7aldef-2e1f-4a7b-a792-ae5275b6ef92" -Domain - 
DomainName "TSQA.contoso.com" 


Question: 20 


You have Windows Server 2012 R2 installation media that contains a file named Install.wim. You 
need to identify the permissions of the mounted images in Install.wim. 
What should you do? 


A. Run dism.exe and specify the /get-mountedwiminfo parameter. 
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B. Run imagex.exe and specify the /verify parameter. 
C. Run imagex.exe and specify the /ref parameter. 
D. Run dism.exe and specify the/get-imageinfo parameter. 


Answer: A 


Explanation: 

/Get-MountedWimInfo Lists the images that are currently mounted and information about the 
mounted image such as read/write permissions, mount location, mounted file path, and mounted 
image index. 

References: 

http: //technet. microsoft. com/en-us/library/cc749447(v=ws. 10). aspx 

http: //technet. microsoft. com/en-us/library/dd744382(v=ws. 10). aspx 

http: //technet. microsoft. com/en-us/library/hh825224. aspx 


Question: 21 


You have a server named Server1 that runs Windows Server 2012 R2. You create a Data Collector Set 
(DCS) named DCS1. 

You need to configure DCS1 to log data to D:\logs. 

What should you do? 


A. Right-click DCS1 and click Properties. 
B. Right-click DCS1 and click Export list. 
C. Right-click DCS1 and click Data Manager. 
D. Right-click DCS1 and click Save template. 


Answer: A 


Explanation: 

The Root Directory will contain data collected by the Data Collector Set. Change this setting if you 
want to store your Data Collector Set data in a different location than the default. Browse to and 
select the directory, or type the directory name. 

To view or modify the properties of a Data Collector Set after it has been created, you can: 

* Select the Open properties for this data collector set check box at the end of the Data Collector Set 
Creation Wizard. 

* Right-click the name of a Data Collector Set, either in the MMC scope tree or in the console 
window, and click Properties in the context menu. 

Directory tab: 

In addition to defining a root directory for storing Data Collector Set data, you can specify a single 
Subdirectory or create a Subdirectory name format by clicking the arrow to the right of the text entry 
field. 


Question: 22 


Your network contains an Active Directory domain named adatum.com. The domain contains a 
member server named Server1 and 10 web servers. All of the web servers are in an organizational 
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unit (OU) named WebServers_OU. All of the servers run Windows Server 2012 R2. 

On Server1, you need to collect the error events from all of the web servers. The solution must 
ensure that when new web servers are added to WebServers_OU, their error events are collected 
automatically on Server1. 

What should you do? 


A. On Server1, create a source computer initiated subscription. From a Group Policy object (GPO), 
configure the Configure target Subscription Manager setting. 

B. On Server1, create a source computer initiated subscription. From a Group Policy object (GPO), 
configure the Configure forwarder resource usage setting. 

C. On Server1, create a collector initiated subscription. From a Group Policy object (GPO), configure 
the Configure forwarder resource usage setting. 

D. On Server1, create a collector initiated subscription. From a Group Policy object (GPO), configure 
the Configure target Subscription Manager setting. 


Answer: A 


Explanation: 

Source-initiated subscriptions allow you to define a subscription on an event collector computer 
without defining the event source computers, and then multiple remote event source computers can 
be set up (using a group policy setting) to forward events to the event collector computer. This differs 
from a collector initiated subscription because in the collector initiated subscription model, the 
event collector must define all the event sources in the event subscription. 

1. Run the following command from an elevated privilege command prompt on the Windows Server 
domain controller to configure Windows Remote Management: winrm qc ~q. 

2. Start group policy by running the following command: %SYSTEMROOT%\System32\gpedit. msc. 

3. Under the Computer Configuration node, expand the Administrative Templates node, then expand 
the Windows Components node, then select the Event Forwarding node. 

4. Right-click the SubscriptionManager setting, and select Properties. Enable the 
SubscriptionManager setting, and click the Show button to add a server address to the setting. Add 
at least one setting that specifies the event collector computer. The SubscriptionManager Properties 
window contains an Explain tab that describes the syntax for the setting. 

5. After the SubscriptionManager setting has been added, run the following command to ensure the 
policy is applied: gpupdate /force. 

If you want to configure a source computer-initiated subscription, you need to configure the 
following group policies on the computers that will act as the event forwarders: 

* (A) Configure Target Subscription Manager This policy enables you to set the location of the 
collector computer. 


Question: 23 


HOTSPOT 

You have a server named Server4 that runs Windows Server 2012 R2. Server4 has the Windows 
Deployment Services server role installed. 

Server4 is configured as shown in the exhibit. (Click the Exhibit button.) 
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File Action View Help 


ra Windows Deployment Services 
4 J Servers 
4 D Server4.Contoso.com 


Boot Images 


image Name 

Ey Bootimage1 
& Bootimage2 
e Bootimage3 


| Install Images 
(=) Boot Images 
aS Pending Devices 
(ap Multicast Transmissions 
p D} Drivers 
b TE Active Directory Prestaged Devices 


3 Boot 
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Image(s) 
Architecture 
x64 

x64 

x86 


Status 
Online 
Online 
Online 


Expanded Size 
1276 MB 
1276 MB 
1026 MB 


Date 

8/23/... 
8/23/... 
8/23/... 


OS Version 
6.3.9431 
6.3.9431 
6.3.9431 


Priority 
100 
10 
10 


To answer, complete each statement according to the information presented in the exhibit. Each 


correct selection is worth one point. 
Answer Area 


When you connect to Windows Deployment 
Services (WDS) from an x64 client 
computer, you can select ,,, 


When you connect to Windows Deployment 
Services (WDS) from an x64 client 
computer, the default image will be ... 


Answer Area 


When you connect to Windows Deployment 
Services (WDS) from an x64 client 
computer, you can select ,,, 


When you connect to Windows Deployment 
Services (WDS) from an x64 client 
computer, the default image will be ... 


Answer Area 


When you connect to Windows Deployment 
Services (WDS) from an x64 client 
computer, you can select ,., 


| z] 


Answer: 


Bootimage3 only. 


Bootimagel and Bootimage2 only. 


Boot! 


age2 and Boot! 


age3 only. 


Bootimagel, Bootimage2, and Bootl mage 


When you connect to Windows Deployment 


Services (WDS) from an x64 client | ~] 


computer, the default image will be ... 
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Question: 24 


Your network contains a Hyper-V host named Hyperv1. Hyperv1 runs Windows Server 2012 R2. 
Hyperv1 hosts four virtual machines named VM1, VM2, VM3, and VM4. AH of the virtual machines 
run Windows Server 2008 R2. 

You need to view the amount of memory resources and processor resources that VM4 currently uses. 
Which tool should you use on Hyperv1? 


A. Windows System Resource Manager (WSRM) 
B. Task Manager 

C. Hyper-V Manager 

D. Resource Monitor 


Answer: C 


Explanation: 

Hyper-V Performance Monitoring Tool 

Know which resource is consuming more CPU. Find out if CPUs are running at full capacity or if they 
are being underutilized. Metrics tracked include Total CPU utilization, Guest CPU utilization, 
Hypervisor CPU utilization, idle CPU utilization, etc. 

WSRM is deprecated starting with Windows Server 2012 


Hyper VY Manager a Of x] 
Ji e Aton View Window Hep alaj xi 
C AEA ali ? lo 


DI Mreer-¥ Minagi 
a 
a 
Yon 
a WIRA20C 
WrbPSP3 Cap 


Inport Vrtud Meche 
Hyper -¥ Settings 
S Virtus Network Manager 
Cat Owh 
Inspect O 
The selected vris mache hat no mnapehot: R00 Serve 


Remove Server 


È Retresd 


oo 
New Window from rere 


g tw 


Crested 8/71/2009 1201 PM 


-- D M 
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Your network contains an Active Directory domain named contoso.com. The domain contains a 
member server named Server1. Server1 runs Windows Server 2012 R2 and has the Hyper-V server 
role installed. 

Server1 hosts 10 virtual machines. A virtual machine named VM1 runs Windows Server 2012 R2 and 
hosts a processor-intensive application named Appt. 

Users report that App1 responds more slowly than expected. 

You need to monitor the processor usage on VM1 to identify whether changes must be made to the 
hardware settings of VM1. 

Which performance object should you monitor on Server1? 


A. Processor 

B. Hyper-V Hypervisor Virtual Processor 

C. Hyper-V Hypervisor Logical Processor 

D. Hyper-V Hypervisor Root Virtual Processor 
E. Process 


Answer: C 


Explanation: 

In the simplest way of thinking the virtual processor time is cycled across the available logical 
processors in a round-robin type of fashion. Thus all the processing power gets used over time, and 
technically nothing ever sits idle. 

To accurately measure the processor utilization of a guest operating system, use the “\Hyper-V 
Hypervisor Logical Processor (Total)\% Total Run Time” performance monitor counter on the Hyper-V 
host operating system. 


Question: 26 


A technician installs a new server that runs Windows Server 2012 R2. 

During the installation of Windows Server Update Services (WSUS) on the new server, the technician 
reports that on the Choose Languages page of the Windows Server Update Services Configuration 
Wizard, the only available language is English. 

The technician needs to download updates in French and English. 

What should you tell the network technician to do to ensure that the required updates are available? 


A. From the Windows Server Update Services Configuration Wizard, configure the server to use the 
Microsoft Update servers. 

B. Install Microsoft SQL Server 2014, and then configure the default collation to include the accent- 
sensitive option. 

C. Change the System Local of the server to French. 

D. Add the French language pack to the server. 


Answer: D 
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